sixtyvividtails

sixtyvividtails.bsky.social

20 February 2025 08:56

🔥 article, excellent feats overview & native bypasses! You have a race in dll btw, "Start" vs event create. Just create it in DllMain (safe, as MS "Dll Best Practices" is outdated af, full of atomic 🐂☣️). Alt: `#pragma comment(linker, "/export:Start=kernel32.SleepEx")`: 10 mins enough for anybody 😹.

James Forshaw

tiraniddo.dev

31 January 2025 12:32

New blog post on the abuse of the IDispatch COM interface to get unexpected objects loaded into a process. Demoed by using this to get arbitrary code execution in a PPL process. googleprojectzero.blogspot.com/2025/01/wind...

hasherezade.bsky.social

27 January 2025 07:40

In case if you wonder what broke #ProcessHollowing on Windows 11 24H2, I have something for you: hshrzd.wordpress.com/2025/01/27/p...

James Forshaw

tiraniddo.dev

09 December 2024 06:32

Lol, found a new PPL injection technique which works on Win11 24H2 (admittedly needs admin, but not that bothered about that). I'll try and blog about it at some point :)

Andrea P

decoder-it.bsky.social

26 November 2024 07:34

I'm glad to release the tool I have been working hard on the last month: #KrbRelayEx A Kerberos relay & forwarder for MiTM attacks! >Relays Kerberos AP-REQ tickets >Manages multiple SMB consoles >Works on Win& Linux with .NET 8.0 >... GitHub: github.com/decoder-it/K...